Sorry this so long email.

This is ps auxw last two lines. I run just one sqwebmail process [root@yoda root]# root 2795 0.0 0.2 1568 380 ? S 08:04 0:00 /usr/local/sbin/courierlogger -pid=/usr/lib/sqwebmail/var/run/sqwebma root 2796 0.3 0.5 3152 896 ? S 08:04 0:00 /usr/lib/sqwebmail/libexec/sqwebmail/sqwebmaild root 2811 0.0 0.4 2420 780 pts0 R 08:05 0:00 ps auxw

i trace sqwebmail process and its child

[root@yoda etc]# strace -p 2796 -f Process 2796 attached - interrupt to quit select(4, [3], NULL, NULL, NULL) = 1 (in [3]) accept(3, 0, NULL) = 5 clone(Process 2814 attached child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x402a40c8) = 2814 [pid 2796] close(5) = 0 [pid 2796] wait4(-1, Process 2796 suspended <unfinished ...> [pid 2814] clone(Process 2815 attached child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x402a40c8) = 2815 [pid 2815] fcntl64(5, F_SETFL, O_RDONLY <unfinished ...> [pid 2814] exit_group(0) = ? Process 2796 resumed Process 2814 detached [pid 2815] <... fcntl64 resumed> ) = 0 [pid 2796] <... wait4 resumed> [WIFEXITED(s) && WEXITSTATUS(s) == 0], 0, NULL) = 2814 [pid 2796] --- SIGCHLD (Child exited) @ 0 (0) --- [pid 2796] select(4, [3], NULL, NULL, NULL <unfinished ...> [pid 2815] close(3) = 0 [pid 2815] read(5, "\307\4\0\0\1", 5) = 5 [pid 2815] alarm(10) = 0 [pid 2815] read(5, "HTTP_HOST=192.168.0.21\0HTTP_USER"..., 1223) = 1223 [pid 2815] alarm(0) = 10 [pid 2815] brk(0) = 0x80c9000 [pid 2815] brk(0x80ea000) = 0x80ea000 [pid 2815] brk(0) = 0x80ea000 [pid 2815] recvmsg(5, {msg_name(0)=NULL, msg_iov(1)=[{"\0", 1}], msg_controllen=20, msg_control=0xbffffbd0, , msg_flags=0}, 0) = 1 [pid 2815] close(0) = 0 [pid 2815] close(1) = 0 [pid 2815] dup(3) = 0 [pid 2815] dup(6) = 1 [pid 2815] close(3) = 0 [pid 2815] close(6) = 0 [pid 2815] fcntl64(0, F_SETFL, O_RDONLY) = 0 [pid 2815] fcntl64(1, F_SETFL, O_RDONLY) = 0 [pid 2815] rt_sigaction(SIGHUP, {0x8076e60, [HUP], SA_RESTORER|SA_RESTART, 0x40157718}, {SIG_DFL}, 8)= 0 [pid 2815] rt_sigaction(SIGINT, {0x8076e60, [INT], SA_RESTORER|SA_RESTART, 0x40157718}, {SIG_DFL}, 8)= 0 [pid 2815] rt_sigaction(SIGPIPE, {0x8076e60, [PIPE], SA_RESTORER|SA_RESTART, 0x40157718}, {SIG_DFL}, 8) = 0 [pid 2815] rt_sigaction(SIGTERM, {0x8076e60, [TERM], SA_RESTORER|SA_RESTART, 0x40157718}, {SIG_DFL}, 8) = 0 [pid 2815] umask(077) = 022 [pid 2815] fstat64(0, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0 [pid 2815] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40018000 [pid 2815] read(0, "username=admin%40chortitzer.com."..., 4096) = 89 [pid 2815] open("/usr/lib/sqwebmail/share/sqwebmail/html", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY) = 3 [pid 2815] fstat64(3, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 [pid 2815] fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 [pid 2815] getdents64(3, /* 4 entries */, 4096) = 104 [pid 2815] open("/usr/lib/sqwebmail/share/sqwebmail/html/en-us/LOCALE", O_RDONLY) = 6 [pid 2815] close(6) = 0 [pid 2815] open("/usr/lib/sqwebmail/share/sqwebmail/html/en/LOCALE", O_RDONLY) = 6 [pid 2815] close(6) = 0 [pid 2815] getdents64(3, /* 0 entries */, 4096) = 0 [pid 2815] close(3) = 0 [pid 2815] open("/usr/lib/sqwebmail/share/sqwebmail/html/en/LANGUAGE", O_RDONLY) = 3 [pid 2815] fstat64(3, {st_mode=S_IFREG|0644, st_size=6, ...}) = 0 [pid 2815] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40019000 [pid 2815] read(3, "en-us\n", 4096) = 6 [pid 2815] read(3, "", 4096) = 0 [pid 2815] close(3) = 0 [pid 2815] munmap(0x40019000, 4096) = 0 [pid 2815] open("/usr/lib/sqwebmail/share/sqwebmail/html/en/LOCALE", O_RDONLY) = 3 [pid 2815] fstat64(3, {st_mode=S_IFREG|0644, st_size=6, ...}) = 0 [pid 2815] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40019000 [pid 2815] read(3, "en_US\n", 4096) = 6 [pid 2815] read(3, "", 4096) = 0 [pid 2815] close(3) = 0 [pid 2815] munmap(0x40019000, 4096) = 0 [pid 2815] open("/usr/lib/sqwebmail/share/sqwebmail/html/en/ISPELLDICT", O_RDONLY) = 3 [pid 2815] fstat64(3, {st_mode=S_IFREG|0644, st_size=8, ...}) = 0 [pid 2815] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40019000 [pid 2815] read(3, "english\n", 4096) = 8 [pid 2815] read(3, "", 4096) = 0 [pid 2815] close(3) = 0 [pid 2815] munmap(0x40019000, 4096) = 0 [pid 2815] open("/usr/lib/sqwebmail/share/sqwebmail/html/en/CHARSET", O_RDONLY) = 3 [pid 2815] fstat64(3, {st_mode=S_IFREG|0644, st_size=17, ...}) = 0 [pid 2815] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40019000 [pid 2815] read(3, "utf-8,iso-8859-1\n", 4096) = 17 [pid 2815] read(3, "", 4096) = 0 [pid 2815] close(3) = 0 [pid 2815] munmap(0x40019000, 4096) = 0 [pid 2815] open("/usr/share/locale/locale-archive", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or directory) [pid 2815] open("/usr/share/locale/locale.alias", O_RDONLY) = 3 [pid 2815] fstat64(3, {st_mode=S_IFREG|0644, st_size=2586, ...}) = 0 [pid 2815] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40019000 [pid 2815] read(3, "# Locale name alias data base.\n#"..., 4096) = 2586 [pid 2815] read(3, "", 4096) = 0 [pid 2815] close(3) = 0 [pid 2815] munmap(0x40019000, 4096) = 0 [pid 2815] open("/usr/share/locale/en_US/LC_IDENTIFICATION", O_RDONLY) = -1 ENOENT (No such file or directory) [pid 2815] open("/usr/share/locale/en/LC_IDENTIFICATION", O_RDONLY) = -1 ENOENT (No such file or directory) [pid 2815] open("/usr/share/locale/en_US/LC_CTYPE", O_RDONLY) = -1 ENOENT (No such file or directory) [pid 2815] open("/usr/share/locale/en/LC_CTYPE", O_RDONLY) = -1 ENOENT (No such file or directory) [pid 2815] pipe([3, 6]) = 0 [pid 2815] clone(Process 2816 attached child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x402a40c8) = 2816 [pid 2815] close(3) = 0 [pid 2815] write(2, "DEBUG: LOGIN: ip=[(null)], usern"..., 60) = 60 [pid 2815] write(2, "DEBUG: LOGIN: ip=[(null)], passw"..., 43) = 43 [pid 2815] socket(PF_UNIX, SOCK_STREAM, 0) = 3 [pid 2815] fcntl64(3, F_SETFL, O_RDONLY|O_NONBLOCK) = 0

[pid 2815] connect(3, {sa_family=AF_UNIX, path="/usr/local/var/spool/authdaemon/socket"}, 110) = -1 ENOENT (No such file or directory) <<<<<<< This one ? ? >>>>>>>

[pid 2815] write(2, "ERR: authdaemon: s_connect() fai"..., 63) = 63 [pid 2815] close(3) = 0 [pid 2815] select(0, NULL, NULL, NULL, {0, 100000} <unfinished ...> [pid 2816] close(6) = 0 [pid 2816] read(3, <unfinished ...> [pid 2815] <... select resumed> ) = 0 (Timeout) [pid 2815] write(2, "INFO: LOGIN FAILED, user=admin@c"..., 68) = 68 [pid 2815] write(6, "CANCELLED\n", 10 <unfinished ...> [pid 2816] <... read resumed> "CANCELLED\n", 2047) = 10 [pid 2815] <... write resumed> ) = 10 [pid 2815] close(6) = 0 [pid 2815] getgid32() = 0 [pid 2815] setgid32(0 <unfinished ...> [pid 2816] read(3, <unfinished ...> [pid 2815] <... setgid32 resumed> ) = 0 [pid 2816] <... read resumed> "", 2037) = 0 [pid 2815] getuid32( <unfinished ...> [pid 2816] close(3) = 0 [pid 2816] socket(PF_UNIX, SOCK_STREAM, 0 <unfinished ...> [pid 2815] <... getuid32 resumed> ) = 0 [pid 2816] <... socket resumed> ) = 3 [pid 2815] setuid32(0) = 0 [pid 2815] open("/usr/lib/sqwebmail/share/sqwebmail/html/en-us/invalid.html", O_RDONLY <unfinished ...> [pid 2816] connect(3, {sa_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) [pid 2816] close(3 <unfinished ...> [pid 2815] <... open resumed> ) = 3 [pid 2816] <... close resumed> ) = 0 [pid 2815] fstat64(1, <unfinished ...> [pid 2816] open("/etc/nsswitch.conf", O_RDONLY <unfinished ...> [pid 2815] <... fstat64 resumed> {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0 [pid 2816] <... open resumed> ) = 3 [pid 2815] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...> [pid 2816] fstat64(3, {st_mode=S_IFREG|0644, st_size=1744, ...}) = 0 [pid 2816] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40019000 [pid 2816] read(3, "#\n# /etc/nsswitch.conf\n#\n# An ex"..., 4096) = 1744 [pid 2816] read(3, <unfinished ...> [pid 2815] <... mmap2 resumed> ) = 0x40019000 [pid 2815] fcntl64(3, F_SETFD, FD_CLOEXEC <unfinished ...> [pid 2816] <... read resumed> "", 4096) = 0 [pid 2815] <... fcntl64 resumed> ) = 0 [pid 2816] close(3 <unfinished ...> [pid 2815] fstat64(3, <unfinished ...> [pid 2816] <... close resumed> ) = 0 [pid 2815] <... fstat64 resumed> {st_mode=S_IFREG|0644, st_size=3539, ...}) = 0 [pid 2815] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x4001a000 [pid 2816] munmap(0x40019000, 4096 <unfinished ...> [pid 2815] read(3, "<?xml version=\"1.0\" encoding=\"is"..., 4096) = 3539 [pid 2816] <... munmap resumed> ) = 0 [pid 2815] open("/usr/lib/sqwebmail/etc/logindomainlist", O_RDONLY <unfinished ...> [pid 2816] open("/usr/local/lib/courier-authlib/libnss_files.so.2", O_RDONLY <unfinished ...> [pid 2815] <... open resumed> ) = -1 ENOENT (No such file or directory) [pid 2816] <... open resumed> ) = -1 ENOENT (No such file or directory) [pid 2815] open("/usr/lib/sqwebmail/share/sqwebmail/html/en-us/TIMEZONELIST", O_RDONLY <unfinished ...> [pid 2816] open("/etc/ld.so.cache", O_RDONLY <unfinished ...> [pid 2815] <... open resumed> ) = 6 [pid 2816] <... open resumed> ) = 3 [pid 2815] fcntl64(6, F_SETFD, FD_CLOEXEC) = 0 [pid 2816] fstat64(3, <unfinished ...> [pid 2815] fstat64(6, {st_mode=S_IFREG|0644, st_size=16552, ...}) = 0 [pid 2815] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 <unfinished ...> [pid 2816] <... fstat64 resumed> {st_mode=S_IFREG|0644, st_size=74556, ...}) = 0 [pid 2816] old_mmap(NULL, 74556, PROT_READ, MAP_PRIVATE, 3, 0) = 0x402a5000 [pid 2815] <... mmap2 resumed> ) = 0x4001b000 [pid 2816] close(3) = 0 [pid 2815] read(6, <unfinished ...> [pid 2816] open("/lib/libnss_files.so.2", O_RDONLY <unfinished ...> [pid 2815] <... read resumed> "# $Id: TIMEZONELIST,v 1.1 2001/1"..., 4096) = 4096 [pid 2816] <... open resumed> ) = 3 [pid 2815] write(1, "Content-Language: en-us\nCache-Co"..., 4096 <unfinished ...> [pid 2816] read(3, <unfinished ...> [pid 2815] <... write resumed> ) = 4096 [pid 2816] <... read resumed> "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@\35\0\000"..., 512) = 512 [pid 2815] read(6, <unfinished ...> [pid 2816] fstat64(3, <unfinished ...> [pid 2815] <... read resumed> "\tCanada: Eastern Standard Time -"..., 4096) = 4096 [pid 2815] write(1, "ba\">Argentina: most locations (C"..., 4096 <unfinished ...> [pid 2816] <... fstat64 resumed> {st_mode=S_IFREG|0755, st_size=40900, ...}) = 0 [pid 2815] <... write resumed> ) = 4096 [pid 2815] write(1, "me - east Nunavut</option>\n<opti"..., 4096) = 4096 [pid 2815] read(6, "Kzyl-Orda)\nAsia/Oral\t\t\tKazakhsta"..., 4096) = 4096 [pid 2815] write(1, "n</option>\n<option value=\"Africa"..., 4096 <unfinished ...> [pid 2816] old_mmap(NULL, 44192, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x402b8000 [pid 2816] old_mmap(0x402c2000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x9000) = 0x402c2000 [pid 2816] close(3 <unfinished ...> [pid 2815] <... write resumed> ) = 4096 [pid 2815] write(1, "yotte</option>\n<option value=\"Am"..., 4096) = 4096 [pid 2815] read(6, "shu\t\tSomalia\nAfrica/Johannesburg"..., 4096) = 4096 [pid 2816] <... close resumed> ) = 0 [pid 2815] write(1, "\"Europe/Kaliningrad\">Russia: Mos"..., 4096 <unfinished ...> [pid 2816] munmap(0x402a5000, 74556) = 0 [pid 2815] <... write resumed> ) = 4096 [pid 2815] read(6, "-10\t\t\t10 hours ahead of GMT\nEtc/"..., 4096) = 168 [pid 2816] open("/etc/passwd", O_RDONLY <unfinished ...> [pid 2815] read(6, "", 4096) = 0 [pid 2816] <... open resumed> ) = 3 [pid 2815] close(6) = 0 [pid 2815] munmap(0x4001b000, 4096) = 0 [pid 2816] fcntl64(3, F_GETFD <unfinished ...> [pid 2815] write(1, "diana/Vevay\">United States: East"..., 4096) = 4096 [pid 2815] read(3, "", 4096) = 0 [pid 2816] <... fcntl64 resumed> ) = 0 [pid 2815] close(3 <unfinished ...> [pid 2816] fcntl64(3, F_SETFD, FD_CLOEXEC <unfinished ...> [pid 2815] <... close resumed> ) = 0 [pid 2816] <... fcntl64 resumed> ) = 0 [pid 2815] munmap(0x4001a000, 4096) = 0 [pid 2815] write(1, "-height: 0\">\n <td align=\"le"..., 642 <unfinished ...> [pid 2816] fstat64(3, <unfinished ...> [pid 2815] <... write resumed> ) = 642 [pid 2815] munmap(0x40019000, 4096 <unfinished ...> [pid 2816] <... fstat64 resumed> {st_mode=S_IFREG|0644, st_size=1268, ...}) = 0 [pid 2815] <... munmap resumed> ) = 0 [pid 2816] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x402a5000 [pid 2815] exit_group(0) = ? Process 2815 detached [pid 2816] read(3, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 1268 [pid 2816] close(3) = 0 [pid 2816] munmap(0x402a5000, 4096) = 0 [pid 2816] setgid32(1) = 0 [pid 2816] setuid32(1) = 0 [pid 2816] exit_group(0) = ? Process 2816 detache 6

[root@yoda root]#

thanks guys

Guido